fix!: validate directories before install by chawyehsu · Pull Request #135 · ScoopInstaller/Install · GitHub

An alternative implementation of #76, relates to #60

This COULD be a BREAKING CHANGE, as the behavior has changed. Before this downstreams may run the installer to install Scoop into a directory that's non-empty, and with this PR it'll fail. But it's certain a bad idea to install Scoop into a non-empty directory because serious problems will arise, we should not support such installation.

Closes ScoopInstaller/Scoop#6655

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

Summary by CodeRabbit

Bug Fixes
- Improved setup path validation for invalid paths.
- File paths and existing non-empty directories are now rejected where applicable.
- Scoop root paths containing spaces are now supported.

Walkthrough

Test-ValidateParameter now validates Scoop, global, and cache paths for invalid paths and existing files. It rejects non-empty Scoop or global directories. Scoop roots containing spaces are no longer rejected. Tests cover each validation case.

Changes

Installation validation

Layer / File(s)	Summary
Installation path validation install.ps1	Test-ValidateParameter rejects invalid paths, existing files, and non-empty Scoop or global directories. Scoop roots may contain spaces.
Path validation tests test/install.Tests.ps1	Parameterized tests cover invalid characters, file-valued paths, and non-empty Scoop or global directories.

🚥 Pre-merge checks | ✅ 5 ✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: validating installation directories before installation. It is concise and specific.
Description check	✅ Passed	The description directly explains the directory validation changes, the prevention of non-empty directory installations, the possible breaking behavior, and the related issue.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Actionable comments posted: 1

ℹ️ Review info ⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e9fb56e-fff1-4947-812b-1ad7b02d2889

📥 Commits

Reviewing files that changed from the base of the PR and between 395043c and 2e5efa4.

📒 Files selected for processing (1)

install.ps1

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

♻️ Duplicate comments (1)

install.ps1 (1)
144-145: ⚠️ Potential issue | 🟡 Minor

Preserve literal, fail-closed directory validation.

Test-Path -Path "$DIR\*" interprets the path as a wildcard. It can miss hidden-only children, and path names containing wildcard characters can resolve incorrectly. The check can therefore allow installation into a non-empty directory. PowerShell documents this wildcard behavior, and hidden-item misses are documented in the PowerShell issue tracker. (learn.microsoft.com)

Use -LiteralPath for the directory check, enumerate with Get-ChildItem -Force, and treat enumeration errors as validation failures. This is the same unresolved issue reported previously.
$root = Join-Path $env:TEMP ("scoop-path-check-" + [guid]::NewGuid())
$hiddenDir = Join-Path $root 'hidden-only'
$specialDir = Join-Path $root 'name[1]'

[System.IO.Directory]::CreateDirectory($hiddenDir) | Out-Null
[System.IO.Directory]::CreateDirectory($specialDir) | Out-Null
$hiddenFile = Join-Path $hiddenDir '.keep'
[System.IO.File]::WriteAllText($hiddenFile, '')
[System.IO.File]::SetAttributes($hiddenFile, [System.IO.FileAttributes]::Hidden)
[System.IO.File]::WriteAllText((Join-Path $specialDir 'keep'), '')

try {
    [pscustomobject]@{
        HiddenOnly_TestPath = Test-Path -Path "$hiddenDir\*"
        HiddenOnly_ForceCount = @(Get-ChildItem -LiteralPath $hiddenDir -Force).Count
        WildcardName_TestPath = Test-Path -Path "$specialDir\*"
        WildcardName_LiteralCount = @(Get-ChildItem -LiteralPath $specialDir -Force).Count
    }
} finally {
    [System.IO.Directory]::Delete($root, $true)
}
Also applies to: 152-153

ℹ️ Review info ⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a41dc48-1fdf-419c-9cdf-a0a3e70dca38

📥 Commits

Reviewing files that changed from the base of the PR and between 2e5efa4 and 20c916d.

📒 Files selected for processing (1)

install.ps1

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

Actionable comments posted: 1

ℹ️ Review info ⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c9935c28-d9cc-4413-b9e1-a6ff41f9ae06

📥 Commits

Reviewing files that changed from the base of the PR and between 7e2af1f and c2419e5.

📒 Files selected for processing (2)

install.ps1
test/install.Tests.ps1

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

chawyehsu mentioned this pull request Aug 27, 2026

refactor!: guard install flow against dot-sourcing #136

Merged

fix: validate directories before install

2e5efa4

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

chawyehsu force-pushed the push-yvolylouprxz branch from 28db0df to 2e5efa4 Compare August 27, 2026 07:36

coderabbitai Bot reviewed Aug 27, 2026

View reviewed changes

Comment thread install.ps1

chawyehsu added 2 commits August 27, 2026 15:59

fix: use test-path

20c916d

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

dont validate spaces for now

7e2af1f

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

coderabbitai Bot reviewed Aug 27, 2026

View reviewed changes

chawyehsu added 2 commits August 27, 2026 16:25

validate dir variables

78a15e2

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

test: add tests for Test-ValidateParameter

c2419e5

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

chawyehsu changed the title fix: validate directories before install fix!: validate directories before install Aug 27, 2026

coderabbitai Bot reviewed Aug 27, 2026

View reviewed changes

Comment thread install.ps1

chawyehsu merged commit c64d414 into ScoopInstaller:master Aug 27, 2026
4 checks passed

chawyehsu mentioned this pull request Sep 2, 2026

fix!: more checks to install path #76

Draft

chawyehsu deleted the push-yvolylouprxz branch September 2, 2026 15:51

fix!: validate directories before install by chawyehsu · Pull Request #135 · ScoopInstaller/Install · GitHub

Uh oh!

Uh oh!

fix!: validate directories before install - #135

fix!: validate directories before install#135
chawyehsu merged 5 commits into
ScoopInstaller:masterfrom
chawyehsu:push-yvolylouprxz

chawyehsu commented Aug 26, 2026 •
edited
Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 27, 2026 •
edited
Loading

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix!: validate directories before install by chawyehsu · Pull Request #135 · ScoopInstaller/Install · GitHub

Uh oh!

Uh oh!

fix!: validate directories before install - #135

fix!: validate directories before install#135chawyehsu merged 5 commits intoScoopInstaller:masterScoopInstaller/Install:masterfrom chawyehsu:push-yvolylouprxzchawyehsu/Install:push-yvolylouprxzCopy head branch name to clipboard

Conversation

chawyehsu commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix!: validate directories before install#135
chawyehsu merged 5 commits into
ScoopInstaller:masterfrom
chawyehsu:push-yvolylouprxz

chawyehsu commented Aug 26, 2026 •
edited
Loading

coderabbitai Bot commented Aug 27, 2026 •
edited
Loading